{ "info": { "author": "Shinho Lee, Wookhyun Jung, Sangwon Kim", "author_email": "lee1029ng@estsecurity.com, pplan5872@estsecurity.com, bestksw@estsecurity.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 3 - Alpha", "License :: OSI Approved :: GNU General Public License v2 or later (GPLv2+)", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.4", "Programming Language :: Python :: 3.5", "Programming Language :: Python :: 3.6", "Programming Language :: Python :: 3.7" ], "description": "Dalvik EXecutable Opcode Fuzzy(Dexofuzzy) Hash\n==============================================\nDexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash value that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash values. \n\n.. image:: https://img.shields.io/badge/license-GPLv2%2B-green.svg\n :target: https://github.com/ESTsecurity/Dexofuzzy\n :alt: License\n\n.. image:: https://img.shields.io/badge/pypi-v3.3-blue.svg\n :target: https://github.com/ESTsecurity/Dexofuzzy\n :alt: Latest Version\n\n.. image:: https://img.shields.io/badge/python-3%20%7C%203.4%20%7C%203.5%20%7C%203.6%20%7C%203.7-blue.svg\n :target: https://pypi.python.org/pypi/ssdeep/\n :alt: Python Versions\n\n\nRequirements\n------------\nDexofuzzy requires the following modules:\n\n* ssdeep 3.3 or later\n\n\nInstall\n-------\n\nInstall on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS\n.................................................\n\n.. code-block:: console\n\n $ apt-get install libffi-dev libfuzzy-dev\n $ pip3 install dexofuzzy\n\nInstall on Debian 8.11, 9.9, 10.0\n.................................\n\n.. code-block:: console\n\n $ apt-get install libffi-dev libfuzzy-dev python3-pip\n $ pip3 install dexofuzzy\n\nInstall on Linux Mint 3, 18.3, 19.1\n...................................\n\n.. code-block:: console\n\n $ apt-get install libffi-dev libfuzzy-dev python3-pip python3-dev\n $ pip3 install setuptools wheel \n $ pip3 install dexofuzzy\n\nInstall on CentOS 6.10, 7.6\n...........................\n\n.. code-block:: console\n\n $ yum install libffi-devel ssdeep ssdeep-devel\n $ pip3 install dexofuzzy\n\nInstall on Windows 7, 10\n........................\n\n* The ssdeep DLL binaries for Windows are included in ./dexofuzzy/bin/ directory.\n\n.. code-block:: console\n\n $ pip3 install dexofuzzy\n\nUsage\n-----\n\n::\n\n usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY] [-m] [-g N]\n [-s DEXOFUZZY DEXOFUZZY] [-c CSV_FILENAME] [-j JSON_FILENAME]\n [-l]\n\n Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash v0.0.3\n\n optional arguments:\n -h, --help show this help message and exit\n -f SAMPLE_FILENAME, --file SAMPLE_FILENAME\n the sample to extract dexofuzzy\n -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY\n the directory of samples to extract dexofuzzy\n -m, --method-fuzzy extract the fuzzyhash based on method of the sample\n (default use the -f or -d option)\n -g N, --clustering N N-gram cluster the dexofuzzy of the sample\n (default use the -d option)\n -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY\n score the dexofuzzy of the sample\n -c CSV_FILENAME, --csv CSV_FILENAME\n output as CSV format\n -j JSON_FILENAME, --json JSON_FILENAME\n output as json format\n (include method fuzzy or clustering)\n -l, --error-log output the error log\n\n\n\nOutput Format Example\n.....................\n* *FileName, FileSha256, FileSize, OpcodeHash, Dexofuzzy*\n\n.. code-block:: console\n\n $ dexofuzzy -f Trojan.Android.SmsSpy.apk \n Trojan.Android.SmsSpy.apk,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,94d36ca47485ca4b1d05f136fa4d9473bb2ed3f21b9621e4adce47acbc999c5d,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q\n Running Time : 0.016620635986328125\n\n* *Method Fuzzy*\n\n.. code-block:: console\n\n $ dexofuzzy -f Trojan.Android.SmsSpy.apk -m \n 80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q\n [\n \"3:mWc0R2gLkcT2AVA:mWc51cTnVA\",\n \"3:b0RdGMVAn:MA\",\n \"3:y+6sMlHdNy+BGZn:y+6sMh5En\",\n \"3:y4CdNy/GZn:y4C+En\",\n \"3:dcpqn:WEn\",\n \"3:EN:EN\",\n ...\n ]\n\n* *Clustering*\n\n.. code-block:: console\n\n $ dexofuzzy -d SAMPLE_DIRECTORY -g 7 \n 80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q\n ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,46504,4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f,48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5\n [\n {\n \"file_name\": \"80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835\",\n \"file_sha256\": \"80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835\",\n \"file_size\": \"42959\",\n \"opcode_hash\": \"d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38\",\n \"dexofuzzy\": \"48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q\",\n \"clustering\": [\n {\n \"file_name\": \"80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835\",\n \"file_sha256\": \"80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835\",\n \"file_size\": \"42959\",\n \"opcode_hash\": \"d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38\",\n \"dexofuzzy\": \"U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY\",\n \"signature\": \"U7uPrEM\"\n },\n {\n \"file_name\": \"ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3\",\n \"file_sha256\": \"ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3\",\n \"file_size\": \"46504\",\n \"opcode_hash\": \"4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f\",\n \"dexofuzzy\": \"B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5\",\n \"signature\": \"7uPrEMc\"\n }\n ]\n },\n {\n ...\n }\n ] \n\n\nPython API\n..........\nTo compute a Dexofuzzy of ``dex file``, use ``hash`` function:\n\n.. code-block:: pycon\n\n >>> import dexofuzzy\n >>> with open('classes.dex', 'rb') as dex:\n ... dex_data = dex.read()\n >>> hash1 = dexofuzzy.hash(dex_data)\n >>> hash1\n '48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'\n >>> with open('classes2.dex', 'rb') as dex:\n ... dex_data = dex.read()\n >>> hash2 = dexofuzzy.hash(dex_data)\n >>> hash2\n '48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'\n\nThe ``compare`` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.\n\n.. code-block:: pycon\n\n >>> dexofuzzy.compare(hash1, hash2)\n 50\n\n\nTested on\n---------\n\n* Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS\n* Debian 8.11, 9.9, 10.0\n* Linux Mint 3, 18.3, 19.1\n* CentOS 6.10, 7.6\n* Windows 7, 10\n\nLicense\n-------\n\nCopyright (C) 2019 ESTsecurity.\n\nThis project is licensed under the GNU General Public License v2 or later (GPLv2+). Please see `LICENSE `__ located at the project's root for more details.\n\n\n\n.. _Dexofuzzy - Android Malware Similarity Clustering Method Using Opcode Sequence: https://www.estsecurity.com/\n\n\n", "description_content_type": "text/x-rst", "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://github.com/ESTsecurity/Dexofuzzy", "keywords": "Android Malware Similarity using Method Opcode Sequence,Android Malware Similarity Fuzzyhash,Method Opcode Sequence Fuzzyhash", "license": "GNU General Public License v2 or later (GPLv2+)", "maintainer": "", "maintainer_email": "", "name": "dexofuzzy", "package_url": "https://pypi.org/project/dexofuzzy/", "platform": "", "project_url": "https://pypi.org/project/dexofuzzy/", "project_urls": { "Homepage": "https://github.com/ESTsecurity/Dexofuzzy" }, "release_url": "https://pypi.org/project/dexofuzzy/0.0.3/", "requires_dist": [ "filetype", "ssdeep ; platform_system != \"Windows\"" ], "requires_python": ">=3", "summary": "Dexofuzzy : Dalvik EXecutable Opcode Fuzzyhash", "version": "0.0.3" }, "last_serial": 5723719, "releases": { "0.0.2": [ { "comment_text": "", "digests": { "md5": "264865af829807c88e3447495c58670a", "sha256": "87e2d18f36c7e54c0cd520d8c19fd293841daf94912d91bf364875de40edea67" }, "downloads": -1, "filename": "dexofuzzy-0.0.2-py3-none-any.whl", "has_sig": false, "md5_digest": "264865af829807c88e3447495c58670a", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": ">=3", "size": 56766, "upload_time": "2019-06-30T04:33:18", "url": "https://files.pythonhosted.org/packages/2f/8a/0a8803fdedda9396cb4986cf4f6c6bbe490c802205050b055249d09b790b/dexofuzzy-0.0.2-py3-none-any.whl" } ], "0.0.3": [ { "comment_text": "", "digests": { "md5": "614cc51174c279049a3e6efa51644a7f", "sha256": "761c8becaba4e546d6e26e3b19ea150a88f1a4255cf7d71d2931ae3e049f7f15" }, "downloads": -1, "filename": "dexofuzzy-0.0.3-py3-none-any.whl", "has_sig": false, "md5_digest": "614cc51174c279049a3e6efa51644a7f", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": ">=3", "size": 58341, "upload_time": "2019-08-24T05:18:45", "url": "https://files.pythonhosted.org/packages/99/15/fb51685dd14261d13c6f00bb9d63979a6842060f2e29ee857a461449c388/dexofuzzy-0.0.3-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "8b6114582081a751aa7fd6be8d6e4f9d", "sha256": "3224895e19a8cd1696941570984b9c11688ed48ecc0dff456bc7074d4aa8faa4" }, "downloads": -1, "filename": "dexofuzzy-0.0.3.tar.gz", "has_sig": false, "md5_digest": "8b6114582081a751aa7fd6be8d6e4f9d", "packagetype": "sdist", "python_version": "source", "requires_python": ">=3", "size": 51052, "upload_time": "2019-08-24T05:18:47", "url": "https://files.pythonhosted.org/packages/c7/46/d9b1647315c0151b3c14a1a82f74c1605b7f1ec82cc35b5f1e510a4dca34/dexofuzzy-0.0.3.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "614cc51174c279049a3e6efa51644a7f", "sha256": "761c8becaba4e546d6e26e3b19ea150a88f1a4255cf7d71d2931ae3e049f7f15" }, "downloads": -1, "filename": "dexofuzzy-0.0.3-py3-none-any.whl", "has_sig": false, "md5_digest": "614cc51174c279049a3e6efa51644a7f", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": ">=3", "size": 58341, "upload_time": "2019-08-24T05:18:45", "url": "https://files.pythonhosted.org/packages/99/15/fb51685dd14261d13c6f00bb9d63979a6842060f2e29ee857a461449c388/dexofuzzy-0.0.3-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "8b6114582081a751aa7fd6be8d6e4f9d", "sha256": "3224895e19a8cd1696941570984b9c11688ed48ecc0dff456bc7074d4aa8faa4" }, "downloads": -1, "filename": "dexofuzzy-0.0.3.tar.gz", "has_sig": false, "md5_digest": "8b6114582081a751aa7fd6be8d6e4f9d", "packagetype": "sdist", "python_version": "source", "requires_python": ">=3", "size": 51052, "upload_time": "2019-08-24T05:18:47", "url": "https://files.pythonhosted.org/packages/c7/46/d9b1647315c0151b3c14a1a82f74c1605b7f1ec82cc35b5f1e510a4dca34/dexofuzzy-0.0.3.tar.gz" } ] }